elasticsearch Logstash无法识别日志时间
我是麋鹿堆栈的新手,但是在阅读了文档之后,我仍然无法让logstash识别麋鹿的自定义时间 日志看起来像这样elasticsearch Logstash无法识别日志时间,elasticsearch,logstash,kibana,elasticsearch,Logstash,Kibana,我是麋鹿堆栈的新手,但是在阅读了文档之后,我仍然无法让logstash识别麋鹿的自定义时间 日志看起来像这样 2014-11-30 03:30:01.000118,122.99.34.242,123.56.212.1,44,u,q,NA,0 ? a.root-servers.net A 我的logstash过滤器是这个 filter { date { #2014-11-30 03:30:01.000118,122.99.34.242,123.56.2
2014-11-30 03:30:01.000118,122.99.34.242,123.56.212.1,44,u,q,NA,0 ? a.root-servers.net A
我的logstash过滤器是这个
filter {
date {
#2014-11-30 03:30:01.000118,122.99.34.242,123.56.212.1,44,u,q,NA,0 ? a.root-servers.net A
match => ["timestamp" , "YYYY-MM-dd HH:mm:ss"]
locale => "en"
}
}
但是,当我通过这个配置文件和日志文件运行它时,它似乎无法识别我定义的匹配
{
"message" => "2014-11-30 03:30:01.011895,123.52.36.153,213.55.121.1,55,u,q,NA,0\t? mobile-collector.newrelic.com A\t",
"@version" => "1",
"@timestamp" => "2014-12-03T03:09:49.857Z",
"type" => "syslog",
"host" => "0.0.0.0",
"path" => "/var/log/dns/2014-11-30_0335_dnsparse.log"
}
我正在运行“logstash 1.4.2-modified”
为了完整起见,这里是我的整个日志存储配置
input {
file {
path => "/var/log/dns/*.log"
type => "dns_parselog"
start_position => beginning
}
}
filter {
date {
#2014-11-30 03:30:01.000118,122.99.34.242,123.56.212.1,44,u,q,NA,0 ? a.root-servers.net A
match => ["timestamp" , "YYYY-MM-dd HH:mm:ss"]
locale => "en"
}
}
output {
elasticsearch {
host => localhost
}
stdout { codec => rubydebug }
}
您要求日期过滤器解析一个名为“timestamp”的字段,但没有这样的字段。首先将消息中的时间戳提取到一个单独的字段,然后使用日期过滤器
filter {
grok {
match => ["message", "%{TIMESTAMP_ISO8601:timestamp}"]
}
date {
match => ["timestamp", "YYYY-MM-dd HH:mm:ss.SSSSSS"]
remove_field => ["timestamp"]
}
}
您可能希望向grok表达式添加其他模式以提取其他字段,但这超出了本问题的范围